CVE-2020-25507

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).

Una asignación de permisos incorrecta durante el script de instalación de TeamworkCloud 18.0 a 19.0 permite a un atacante local sin privilegios ejecutar código arbitrario como root. Durante la instalación, se le indica al usuario que configure el archivo de entorno del sistema con permisos de escritura mundiales (0777 /etc/environment). Cualquier usuario local sin privilegios puede ejecutar código arbitrario simplemente escribiendo en /etc/environment, lo que obligará a todos los usuarios, incluyendo a root, a ejecutar código arbitrario durante el siguiente inicio de sesión o reinicio. Además, todo el directorio home del usuario de twcloud en /home/twcloud recibe recursivamente permisos de escritura mundial. Esto permite a cualquier atacante local sin privilegios ejecutar código arbitrario, como twcloud. Este producto fue previamente llamado Almacén de Datos de la Empresa Cameo (CEDW)

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-09-14 CVE Reserved
2020-12-28 CVE Published
2024-05-02 EPSS Updated
2024-08-04 CVE Updated
2024-08-04 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

References (7)

URL	Tag	Source
https://community.nomagic.com/finding-and-fixing-wrong-file-permission-twc-installation-t7165.html	X_refsource_confirm
https://docs.nomagic.com/display/TWCloud190/Installation+on+Linux+using+scripts	Third Party Advisory
https://sick.codes/finding-a-vulnerability-in-teamwork-cloud-server-nomagic-3ds-which-is-used-by-gov-enterprise-to-design-rockets-missiles-and-satellites	X_refsource_misc
https://sick.codes/sick-2020-002	X_refsource_misc
https://web.archive.org/web/20201219095507/https://docs.nomagic.com/display/TWCloud185SP1/Installation+on+Centos+7.	X_refsource_misc
https://web.archive.org/web/20201219155833/https://docs.nomagic.com/pages/viewpage.action?pageId=20846937	X_refsource_misc

URL	Date	SRC
https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-002.md	2024-08-04

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
3ds Search vendor "3ds"		Teamwork Cloud Search vendor "3ds" for product "Teamwork Cloud"				>= 18.0 <= 19.0 Search vendor "3ds" for product "Teamwork Cloud" and version " >= 18.0 <= 19.0"		-		Affected